0

I have a tenant setup where a unknown number of companies could create accounts, of the kind company.app.com.

The backend server them as : 5000/company/...., so how do a rewrite (not a redirect!) in nginx? This is what I have:

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    ssl        on;
    ssl_certificate         /etc/ssl/certs/cert.pem;
    ssl_certificate_key     /etc/ssl/private/key.pem;

    server_name ????.app.com; <-- How?
    
    charset    utf-8;
    
    location / {
        proxy_pass         http://0.0.0.0:5000;
        proxy_http_version 1.1;
        proxy_set_header   Connection "";
        proxy_connect_timeout       300;
        proxy_send_timeout          300;
        proxy_read_timeout          300;
        send_timeout                300;            
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Host $server_name;
    }
}

Now the issues is that I need to rule out a small list of subdomains (www, dash, mail) so how is this done?

2

One can capture part of the Host header / TLS SNI field into a variable in server_name like this:

server_name ~^(?<company>.+)\.app\.com;

Later on, the variable can be used in proxy_pass destination:

proxy_pass http://192.168.100.100:5000/$company/;

It is useful to know the matching rules, which are explained in nginx server names documentation.

| improve this answer | |
0

My comment would be to long for a comment, excuse me.

In Reference to the NGINX Documentation:

A wildcard name may contain an asterisk only on the name’s start or end, and only on a dot border. The names “www..example.org” and “w.example.org” are invalid. However, these names can be specified using regular expressions, for example, “~^www..+.example.org$” and “~^w..example.org$”. An asterisk can match several name parts. The name “.example.org” matches not only www.example.org but www.sub.example.org as well.

When searching for a virtual server by name, if name matches more than one of the specified variants, e.g. both wildcard name and regular expression match, the first matching variant will be chosen, in the following order of precedence:

  • exact name
  • longest wildcard name starting with an asterisk, e.g. “*.example.org”
  • longest wildcard name ending with an asterisk, e.g. “mail.*”
  • first matching regular expression (in order of appearance in a configuration file)

A special wildcard name in the form “.example.org” can be used to match both the exact name “example.org” and the wildcard name “*.example.org”.

Since NGINX supports wildcard it could be like:

server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
ssl        on;
ssl_certificate         /etc/ssl/certs/cert.pem;
ssl_certificate_key     /etc/ssl/private/key.pem;

server_name *.app.com;

charset    utf-8;

location / {
    proxy_pass         http://0.0.0.0:5000;
    proxy_http_version 1.1;
    proxy_set_header   Connection "";
    proxy_connect_timeout       300;
    proxy_send_timeout          300;
    proxy_read_timeout          300;
    send_timeout                300;            
    proxy_set_header   Host $host;
    proxy_set_header   X-Real-IP $remote_addr;
    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header   X-Forwarded-Host $server_name;
}
}

or even:

server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
ssl        on;
ssl_certificate         /etc/ssl/certs/cert.pem;
ssl_certificate_key     /etc/ssl/private/key.pem;

server_name *corp.app.com;

charset    utf-8;

location / {
    proxy_pass         http://0.0.0.0:5000;
    proxy_http_version 1.1;
    proxy_set_header   Connection "";
    proxy_connect_timeout       300;
    proxy_send_timeout          300;
    proxy_read_timeout          300;
    send_timeout                300;            
    proxy_set_header   Host $host;
    proxy_set_header   X-Real-IP $remote_addr;
    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header   X-Forwarded-Host $server_name;
}
}

Both should work.

| improve this answer | |
  • I do this and the server do redirects as "*.app.com" instead of "name.app.com" – mamcx 16 hours ago

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.